masslogger | 5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5

General

Target

5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5.exe
Size

1.1MB
MD5

81db2585a19b1ed404d174c3205136a9
SHA1

29baba83a48e25e886f7cf10f7e4467cc1818eee
SHA256

5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5
SHA512

caef3367d2f89c17fbc088c4bea057ec48c1e164f03e5659bd64c9a93353a0368c0c9f94cd6faa910029a301531bdce6c9f964566a4caedffa916bc55643c2b9

Score

10^/10

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1192-131-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger

Suspicious use of SetThreadContext 1 IoCs

Processes:

5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5.exe

description	pid	process	target process
PID 728 set thread context of 1192	728	5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5.exe	5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5.exe

pid	process
1192	5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5.exe
1192	5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5.exe

description pid process

Token: SeDebugPrivilege 1192 5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5.exe

description	pid	process
Token: SeDebugPrivilege	1192	5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5.exe

description	pid	process	target process
PID 728 wrote to memory of 1192	728	5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5.exe	5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5.exe
PID 728 wrote to memory of 1192	728	5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5.exe	5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5.exe
PID 728 wrote to memory of 1192	728	5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5.exe	5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5.exe
PID 728 wrote to memory of 1192	728	5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5.exe	5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5.exe
PID 728 wrote to memory of 1192	728	5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5.exe	5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5.exe
PID 728 wrote to memory of 1192	728	5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5.exe	5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5.exe
PID 728 wrote to memory of 1192	728	5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5.exe	5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5.exe
PID 728 wrote to memory of 1192	728	5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5.exe	5643a3a858f8ea5110382e436e7f71ace8dc95f48fd61e05d86c370bf622dbb5.exe

memory/728-124-0x0000000000DD0000-0x0000000000EE6000-memory.dmp

Filesize
1.1MB

Download
memory/728-125-0x0000000005780000-0x000000000581C000-memory.dmp

Filesize
624KB

Download
memory/728-126-0x0000000005DD0000-0x0000000006374000-memory.dmp

Filesize
5.6MB

Download
memory/728-127-0x00000000058C0000-0x0000000005952000-memory.dmp

Filesize
584KB

Download
memory/728-128-0x0000000005740000-0x000000000574A000-memory.dmp

Filesize
40KB

Download
memory/728-129-0x0000000005A60000-0x0000000005AB6000-memory.dmp

Filesize
344KB

Download
memory/1192-130-0x0000000000000000-mapping.dmp

Download
memory/1192-131-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download